By comparing infected files with known good files (from official sources or reliably clean backups) you can identify and remove malicious changes.

Caution

To manually remove a malware infection from your Joomla! files:

1. Log into your server via SFTP or SSH.

2. Create a backup of the site files before making changes.

3. Search your files for reference to malicious domains or payloads you noted.

4. Identify recently changed files and confirm whether they are legitimate.

5. Review files flagged by the diff command during the core file integrity check.

6. Restore or compare suspicious files with clean backups or official sources.

7. Remove any suspicious or unfamiliar code from your custom files.

8. Test to verify the site is still operational after changes.

If you can't find the malicious content, try searching the web for malicious content, payloads, and domain names that you found in the first step. Chances are that someone else has already figured out how those domain names are involved in the hack you are attempting to clean.

Diff tools to compare suspicious files with known-good copies:

• DiffNow
• Diff (bash command)
• DiffChecker

---

 

You simply can’t be 100% safe from getting your website hacked. But fortunately there are ways to help reduce the chances of being hacked and recover quickly if some clever hacker still succeeds.

If files have been modified on your server, or files have been uploaded for instance, you can check the timestamps on those files to find out when the attacker was on your site. This is typical in the case of sites being defaced or malicious code being injected somewhere. Most of the time, the attacker will have gained access to your site shortly before modifying or uploading files to it.

After upgrading from Joomla 3.* to Joomla 4.* you can have this error in various places:

Column 'checked_out' cannot be null

Recently during a lenghtly upgrading process of an old Joomla 3 site to Joomla 4 I have run into an unusual issue. During the process of rebuilding/rebranding the site a large number of articles where added to the original site, and obviously they are missing from the new site. I imported articles directly in the database into the #__content table like I often did in Joomla 3 - a smooth process generally. However even the database looked ok, the new articles in Joomla 4 they were not visible.